Vendor OpenClaw source as Adolf fork baseline

Adolf is a fork/vendored clone of github.com/openclaw/openclaw (v2026.6.11),
free to diverge. Tree copied sans upstream .git; upstream remote added for
future syncs. Node pinned to 24 (.nvmrc); engines already require >=22.19.
Preserves docs/ARCHITECTURE.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LeqyaxJF2nbRXJtae2kNB2

docs/clawhub/cli.md

@@ -0,0 +1,99 @@
+---
+summary: "ClawHub CLI entry points for discovering, installing, publishing, and verifying OpenClaw skills and plugins."
+read_when:
+  - You want to use ClawHub from the command line
+  - You want to install ClawHub skills or plugins through OpenClaw
+  - You want to publish ClawHub packages
+title: "ClawHub CLI"
+---
+
+# ClawHub CLI
+
+Two command-line surfaces talk to ClawHub:
+
+- `openclaw skills` / `openclaw plugins` - discover, install, and update
+  packages for a local OpenClaw agent or Gateway.
+- The standalone `clawhub` CLI - publisher workflows: login, publish, sync,
+  and transfer.
+
+## Discover and install
+
+```bash
+openclaw skills search "calendar"
+openclaw skills install @owner/<slug>
+openclaw skills install @owner/<slug> --version <version> --global
+openclaw skills update @owner/<slug>
+openclaw skills update --all --acknowledge-clawhub-risk
+openclaw skills verify @owner/<slug> --card
+
+openclaw plugins search "calendar"
+openclaw plugins install clawhub:<package>
+openclaw plugins install clawhub:<package> --acknowledge-clawhub-risk
+openclaw plugins update <id-or-npm-spec>
+openclaw plugins update --all
+```
+
+Skill installs target the active workspace `skills/` directory by default; add
+`--global` for the shared managed skills directory. Plugin installs need the
+explicit `clawhub:` prefix to force ClawHub resolution over npm, git, or a
+local path. Full flag reference: [`openclaw skills`](/cli/skills) and
+[`openclaw plugins`](/cli/plugins).
+
+### Release trust
+
+OpenClaw checks a release's ClawHub trust state before downloading it, for
+both skills and plugins. Versioned releases use exact-release trust metadata;
+resolver-backed GitHub skills go through ClawHub's install resolver, which
+enforces scan and force-install policy before returning a pinned commit.
+
+- **Malicious or blocked** releases are refused outright.
+- **Risky** releases (non-clean scan, non-blocking moderation state) print a
+  warning and require `--acknowledge-clawhub-risk` to continue
+  non-interactively.
+- **Official ClawHub publishers/packages and bundled OpenClaw sources** skip
+  the trust prompt and security-verdict fetch entirely.
+
+## Publish and maintain
+
+Install the standalone CLI once, then log in:
+
+```bash
+npm i -g clawhub
+clawhub login
+```
+
+Publish a plugin package (folder path, GitHub repo `owner/repo[@ref]`, or
+tarball URL) with `clawhub package publish`:
+
+```bash
+clawhub package publish ./my-plugin --dry-run
+clawhub package publish ./my-plugin
+clawhub package publish your-org/your-plugin@v1.0.0
+```
+
+Publish a skill folder with `clawhub skill publish`:
+
+```bash
+clawhub skill publish ./skills/review-helper
+clawhub skill publish ./skills/review-helper --version 1.0.0 --owner your-org
+```
+
+Other maintenance commands:
+
+```bash
+clawhub sync --all                                          # scan local skills, publish new/updated ones
+clawhub package transfer @old-owner/package --to new-owner   # move a plugin package to another publisher
+clawhub skill rename old-slug new-slug                       # rename a published skill, redirect the old slug
+clawhub explore --sort trending                              # browse the registry, sorted by trending
+```
+
+## Related
+
+- [`openclaw skills`](/cli/skills) - local skill search, install, update, and
+  verification
+- [`openclaw plugins`](/cli/plugins) - plugin search, install, update, and
+  inspection
+- [ClawHub publishing](/clawhub/publishing) - owner scope, release validation,
+  and review flow
+- [Creating skills](/tools/creating-skills) - skill authoring and publish flow
+- [Building plugins](/plugins/building-plugins) - plugin package authoring

docs/clawhub/publishing.md

@@ -0,0 +1,95 @@
+---
+summary: "How ClawHub publishing works for skills, plugins, owners, scopes, releases, and review."
+read_when:
+  - Publishing a skill or plugin
+  - Debugging owner or package scope errors
+  - Adding publish UI, CLI, or backend behavior
+---
+
+# Publishing on ClawHub
+
+ClawHub publishing is owner-scoped: every publish targets a publisher, and the
+server decides whether the signed-in user can publish there.
+
+## Owners
+
+An owner is a ClawHub publisher handle, such as `@alice` or `@openclaw`.
+Every user gets a personal owner; org owners can have multiple members with
+`owner`, `admin`, or `publisher` roles.
+
+When you publish, you use your personal owner or an org owner where you have
+publisher access.
+
+## Skills
+
+Skills publish from a skill folder (`clawhub skill publish <path>`). The
+public page is:
+
+```text
+https://clawhub.ai/<owner>/<slug>
+```
+
+Example:
+
+```text
+https://clawhub.ai/alice/review-helper
+```
+
+The publish request includes the selected owner, slug, version, changelog, and
+files. The server verifies the actor can publish as that owner before creating
+the release.
+
+## Plugins
+
+Plugins use npm-style package names (`clawhub package publish <source>`).
+Scoped names include the owner in the first path segment:
+
+```text
+@owner/package-name
+```
+
+The scope must match the selected publish owner. A package named
+`@openclaw/dronzer` can only be published as `@openclaw`. To publish as
+`@vintageayu`, rename the package to `@vintageayu/dronzer`.
+
+This stops a package from claiming an org namespace the publisher does not
+control.
+
+## Release flow
+
+1. The UI, CLI, or GitHub workflow gathers package metadata and files.
+2. The publish request goes to ClawHub with the selected owner.
+3. The server validates owner permissions, package scope, package name,
+   version, file limits, and source metadata. Validation failure means no
+   release is created.
+4. ClawHub stores the release and starts automated security checks.
+5. The release stays hidden from normal install/download surfaces until
+   review and verification finish.
+
+## FAQ
+
+### Package scope must match selected owner
+
+If the package scope and selected owner do not match, ClawHub rejects the
+publish:
+
+```text
+Package scope "@openclaw" must match selected owner "@vintageayu".
+Publish as "@openclaw" or rename this package to "@vintageayu/dronzer".
+```
+
+Fix it by either publishing as the owner named in the scope, or renaming the
+package so its scope matches the owner you can publish as.
+
+If the package already has the right scope but the wrong publisher owns it,
+transfer it instead:
+
+```sh
+clawhub package transfer @opik/opik-openclaw --to opik
+```
+
+Package transfer needs admin access to both the current owner and the
+destination publisher; it does not let you publish into a scope you do not
+control. This is the same namespace protection: a package named
+`@openclaw/dronzer` claims the `@openclaw` namespace, so only publishers with
+access to `@openclaw` can publish or transfer into it.